Apple is rushing to patch a major operating system vulnerability that left Mac computers open to hacking. Here’s how readers can fix it now.
CNBC reports that a bug in Apple’s High Sierra operating system allowed users to gain access to the file systems admin account simply by entering the username “root” without any password. Software engineer Lemi Orhan Ergin tweeted, “Dear @AppleSupport, we noticed a *HUGE* security issue at MacOS High Sierra. Anyone can login as “root” with empty password after clicking on login button several times. Are you aware of it @Apple?” Orhan then explained how the bug could be replicated,
Dear @AppleSupport, we noticed a *HUGE* security issue at MacOS High Sierra. Anyone can login as "root" with empty password after clicking on login button several times. Are you aware of it @Apple?
— Lemi Orhan Ergin (@lemiorhan) November 28, 2017
You can access it via System Preferences>Users & Groups>Click the lock to make changes. Then use "root" with no password. And try it for several times. Result is unbelievable! pic.twitter.com/m11qrEvECs
— Lemi Orhan Ergin (@lemiorhan) November 28, 2017
Apple Support invited Ergin to discuss the matter further with them saying, “Let’s take a closer look at what’s happening together.”
Let's take a closer look at what's happening together. Send us a DM that includes your Mac model along with your macOS version. We'll meet up with you there. https://t.co/GDrqU22YpT
— Apple Support (@AppleSupport) November 28, 2017
Apple is in the process of releasing a patch that will be available via the App Store, according to a company statement:
Security is a top priority for every Apple product, and regrettably we stumbled with this release of macOS.
When our security engineers became aware of the issue Tuesday afternoon, we immediately began working on an update that closes the security hole. This morning, as of 8:00 a.m., the update is available for download, and starting later today it will be automatically installed on all systems running the latest version (10.13.1) of macOS High Sierra.
We greatly regret this error and we apologize to all Mac users, both for releasing with this vulnerability and for the concern it has caused. Our customers deserve better. We are auditing our development processes to help prevent this from happening again.
But for those running the OS that desire an immediate fix, MacWorld has provided the following steps:
- Open the Finder.
- Click on Go > Go to Folder.
- Type: /System/Library/CoreServices/Applications/ in the text box.
- Click Go.
- Open Spotlight by pressing Command+Space.
- Search for the Directory Utility app and open it.
- Click on the lock icon so you can make changes.
- Enter your name and password in the pop-up window.
- Click Modify Configuration.
- Click on Edit.
- Select Change Root Password.
- Enter your new password and verify it.
- Click OK.
- Now click the lock again to lock it so no more changes can be made.
- Quit Directory Utility.
Lucas Nolan is a reporter for Breitbart News covering issues of free speech and online censorship. Follow him on Twitter @LucasNolan_ or email him at [email protected].
Apple is rushing to patch a major operating system vulnerability that left Mac computers open to hacking. Here’s how readers can fix it now.
CNBC reports that a bug in Apple’s High Sierra operating system allowed users to gain access to the file systems admin account simply by entering the username “root” without any password. Software engineer Lemi Orhan Ergin tweeted, “Dear @AppleSupport, we noticed a *HUGE* security issue at MacOS High Sierra. Anyone can login as “root” with empty password after clicking on login button several times. Are you aware of it @Apple?” Orhan then explained how the bug could be replicated,
Dear @AppleSupport, we noticed a *HUGE* security issue at MacOS High Sierra. Anyone can login as "root" with empty password after clicking on login button several times. Are you aware of it @Apple?
— Lemi Orhan Ergin (@lemiorhan) November 28, 2017
You can access it via System Preferences>Users & Groups>Click the lock to make changes. Then use "root" with no password. And try it for several times. Result is unbelievable! pic.twitter.com/m11qrEvECs
— Lemi Orhan Ergin (@lemiorhan) November 28, 2017
Apple Support invited Ergin to discuss the matter further with them saying, “Let’s take a closer look at what’s happening together.”
Let's take a closer look at what's happening together. Send us a DM that includes your Mac model along with your macOS version. We'll meet up with you there. https://t.co/GDrqU22YpT
— Apple Support (@AppleSupport) November 28, 2017
Apple is in the process of releasing a patch that will be available via the App Store, according to a company statement:
Security is a top priority for every Apple product, and regrettably we stumbled with this release of macOS.
When our security engineers became aware of the issue Tuesday afternoon, we immediately began working on an update that closes the security hole. This morning, as of 8:00 a.m., the update is available for download, and starting later today it will be automatically installed on all systems running the latest version (10.13.1) of macOS High Sierra.
We greatly regret this error and we apologize to all Mac users, both for releasing with this vulnerability and for the concern it has caused. Our customers deserve better. We are auditing our development processes to help prevent this from happening again.
But for those running the OS that desire an immediate fix, MacWorld has provided the following steps:
- Open the Finder.
- Click on Go > Go to Folder.
- Type: /System/Library/CoreServices/Applications/ in the text box.
- Click Go.
- Open Spotlight by pressing Command+Space.
- Search for the Directory Utility app and open it.
- Click on the lock icon so you can make changes.
- Enter your name and password in the pop-up window.
- Click Modify Configuration.
- Click on Edit.
- Select Change Root Password.
- Enter your new password and verify it.
- Click OK.
- Now click the lock again to lock it so no more changes can be made.
- Quit Directory Utility.
Lucas Nolan is a reporter for Breitbart News covering issues of free speech and online censorship. Follow him on Twitter @LucasNolan_ or email him at [email protected].
